What is the CVSS score of EUVD-2026-56582?

EUVD-2026-56582 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Microsoft SharePoint are affected by EUVD-2026-56582?

Microsoft Office SharePoint contains a privilege escalation vulnerability enabling low-privilege authenticated users to forge internal server requests, potentially reaching administrative systems and…. A patch is available.

How to fix or mitigate EUVD-2026-56582?

Within 24 hours, inventory all Microsoft Office SharePoint deployments in your environment, document versions and integrated systems, and audit which user groups present SSRF risk vectors. Within 7 days, implement network-level compensating controls including egress filtering to restrict SharePoint outbound connections to internal networks, configure IP-based whitelisting for administrative endpoints, and deploy WAF rules to detect SSRF patterns. Within 30 days, establish a vendor patch monitoring process for Microsoft security advisories, audit all internal systems accessible from SharePoint instances, and prepare a deployment plan for when fixes become available.

Microsoft SharePoint EUVD-2026-56582

| CVE-2026-70324 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-08-11 secure@microsoft.com

GHSA-3h89-9mrm-gjxw

SSRF Microsoft Sharepoint Server

8.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

SSRF enabling privilege escalation into internal services argues for S:C (changed scope); all other metrics align with the provided vector.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 11, 2026 - 18:19 EUVD

Analysis Generated

Aug 11, 2026 - 17:54 vuln.today

CVE Published

Aug 11, 2026 - 17:19 nvd

HIGH 8.8

DescriptionCVE.org

Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Server-side request forgery in Microsoft Office SharePoint enables low-privileged authenticated attackers to escalate privileges with no user interaction required, achieving high confidentiality, integrity, and availability impact. The flaw (CWE-918) allows a legitimate but low-privilege account holder to forge server-side HTTP requests, likely reaching internal administrative interfaces or credential endpoints inaccessible from the network perimeter. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Technical ContextAI

CWE-918 (Server-Side Request Forgery) arises when a server-side application fetches a remote resource based on attacker-controlled input without validating the destination. In Microsoft Office SharePoint, this means the SharePoint application server can be induced to issue HTTP requests to internal back-end systems - bypassing network segmentation that would normally prevent direct attacker access to those targets. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms the attack is fully network-reachable, requires only a low-privilege SharePoint account, imposes no complexity barrier, and requires no victim interaction. The high-impact triad (C:H/I:H/A:H) with S:U suggests the privilege escalation lands within SharePoint's own security domain rather than pivoting to a fully separate system, but the practical effect is full compromise of the SharePoint environment. Reported by secure@microsoft.com, indicating disclosure originated from Microsoft's own security team.

RemediationAI

The primary remediation is to apply the patch issued by Microsoft, detailed in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70324. Exact fixed version numbers are not present in the supplied intelligence data and must be confirmed directly from that advisory - do not rely on version numbers not independently sourced from Microsoft. While patching is pending, restrict SharePoint access to only explicitly trusted and necessary user accounts, reducing the pool of low-privilege accounts that could trigger the SSRF. Additionally, configure outbound network filtering on SharePoint servers to block requests to internal infrastructure ranges (RFC 1918 addresses, internal DNS names, cloud metadata endpoints such as 169.254.169.254), which directly limits what an SSRF exploit can reach - this is a meaningful compensating control with minimal operational impact on normal SharePoint functionality. Monitor SharePoint server outbound connection logs for anomalous requests to internal hosts.